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AMENDMENTS TO THE CLAIMS 

This listing of claims will replace all prior versions, and listings, of claims in the 
application: 
Listing of Claims: 

1 . (Currently Amended) A method performed by one or more [[a]] server devices , 
the method comprising: 

collecting, by one or more processors a processor of the one or more server 
devices , information associated with a group of users visiting a web site that includes an 
advertising link, where the group of users visiting the web site includes a first set of non- 
malicious users and a different second set of malicious users ; 

identifying, by one or more processors of the processor one or more server 
devices , the set of non-malicious users visiting the web site from the group of users visiting the 
web site based on the collected information; 

identifying, by one or more processors of the one or more server devices, a first 
proportion of a number of non-malicious users visiting the web site to a total number of users 
visiting the web site; and 

determining, by one or more processors of the processor one or more server 
devices , an occurrence of spamming on the web site , where based at least in part on a behavior of 
the determining includes: 

identifying a second proportion of a number of clicks on the advertising 
link by identified non-malicious users to a total number of clicks on the advertising link by the 
group of users, and 

comparing the identified first proportion to the identified second 
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proportion . 



2. (Previously Presented) The method of claim 1 where the collecting information 
includes: 

tracking activities of the group of users visiting the web site. 

3. (Previously Presented) The method of claim 2 where the tracking activities 
includes: 

determining whether the users in the group of users load images. 

4. (Previously Presented) The method of claim 2 where the tracking activities 
includes: 

determining whether the users in the group of users have javascript turned on. 

5. (Previously Presented) The method of claim 2 where the tracking activities 
includes: 

determining a type of browser used by the users in the group of users. 

6. (Previously Presented) The method of claim 2 where the tracking activities 
includes: 

determining an interval at which each of the users in the group of users visits the 

web site. 
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7. (Previously Presented) The method of claim 2 where the web site is a search 
engine, and 

where the tracking activities includes: 

determining a type of items for which searches are performed by the users 

in the group of users. 

8. (Previously Presented) The method of claim 2 where the tracking activities 
includes: 

tracking activities of users in the group of users visiting another web site. 

9. (Previously Presented) The method of claim 2 where each of the users in the 
group of users is associated with a cookie identifier, and 

where the tracking includes: 

using the cookie identifiers to track the activities of the users in the group 

of users. 

10. (Previously Presented) The method of claim 1 where each of the users in the 
group of users is associated with a cookie identifier, and 

where the identifying non-malicious users includes: 

identifying non-malicious users based at least in part on an age of the 
cookie identifiers associated with the users in the group of users. 

1 1 . (Previously Presented) The method of claim 1 where each of the users in the 
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group of users is associated with a network address, and 

where the identifying non-malicious users includes: 

identifying the non-malicious users based at least in part on the network 
addresses associated with the users in the group of users. 



12. (Canceled) 



13. (Canceled) 



14. (Canceled) 



15. (Previously Presented) The method of claim 1 where the determining includes: 

determining an occurrence of spamming of at least one advertisement on the web 

site, and 

where the method further comprises: 

providing a refund in response to determining that the at least one 
advertisement has been spammed. 



16. (Currently Amended) A system comprising: 

means for providing a web site that includes at least one advertisement to a 
plurality of visitors, where the plurality of visitors includes a plurality of malicious visitors and a 
plurality of non-malicious visitors, 

means for identifying malicious visitors to the web site; 
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means for identifying non-malicious visitors to the [[a]] web site; 

means for determining a percentage of the non-malicious visitors out of the 

plurality of visitors to the website; 

means for tracking at least one activity of the identified non-malicious visitors; 

and 

means for determining an occurrence of click spamming on the web site based at 
least in part on the tracked at least one activity of the identified non-malicious visitors , where the 
means for determining the occurrence of click spamming include: 

means for comparing the percentage of non-malicious users selecting the 
at least one advertisement during the time period to the percentage of non-malicious users 
visiting the web site during the time period, and 

means for determining that the at least one advertisement has been 
spammcd when the percentage of non-malicious users selecting the at least one advertisement 
during the time period is significantly lower than the percentage of non-malicious users visiting 
the web site during the time period . 

17. (Previously Presented) A computer-readable memory device containing 
instructions for controlling at least one processor to perform a method for detecting click 
spamming of an advertisement on a server, the method comprising: 

determining a number of non-malicious users accessing the server; 

determining a percentage of the non-malicious users clicking the advertisement 
when the advertisement is provided to the non-malicious users; and 

determining whether the advertisement has been click spammed based at least in 
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part on the determined percentage. 

18. (Previously Presented) A server comprising: 

a memory to store at least one advertisement; and 

a processor to: 

cause the at least one advertisement to be presented, 

determine a number of non-malicious users accessing the server, 

determine a percentage of the non-malicious users clicking the at least one 

advertisement, and 

determine whether the at least one advertisement has been click spammed 
based at least in part on the determined percentage. 

19. (Currently Amended) A method performed by one or more [[a]] server devices , 
the method comprising: 

identifying, by one or more processors a processor of the one or more server 
devices , a group of non-malicious users visiting a web site; 

determining, by one or more processors of the processor one or more server 
devices , a click rate of an item associated with the web site for the group of non-malicious users; 
and 

determining, by one or more processors of the processor one or more server 
devices , whether the item has been click spammed based at least in part on the determined click 
rate for the non-malicious users. 
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20. (Previously Presented) The method of claim 19 further comprising: 
determining a total number of users visiting the web site, and 

where the determining whether the item has been click spammed includes: 

comparing the determined click rate for the non-malicious users to a click 

rate for the total number of users visiting the web site, and 

determining that the item has been click spammed when the click rate for 

the total number of users exceeds the determined click rate for the non-malicious users. 

21. (Previously Presented) The method of claim 19 where the identifying includes: 
tracking an activity of users visiting the web site, and 

identifying the group of non-malicious users based at least in part on the tracked 

activity. 

22. (Previously Presented) The method of claim 21 where the tracking includes 
determining, for each user, at least one of whether the user loads images, an age of a cookie 
associated with each user, whether the user has javascript turned on, a type of browser used by 
the user, or an interval at which the user visits the web site. 

23. (Original) The method of claim 19 further comprising: 

taking remedial measures in response to determining that the item has been click 

spammed. 

24. (Previously Presented) The method of claim 19 where the determining a click 
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rate of the item for the group of non-malicious users includes: 

estimating a percentage of non-malicious users visiting the web site, and 

setting a percentage of clicks of the item from non-malicious users to 

approximately equal the estimated percentage. 

25. (Previously Presented) The method of claim 24 where the determining whether 
the item has been click spammed includes: 

determining whether an actual click rate of the item for the group of non- 
malicious users differs from the set percentage of clicks of the item. 

26. (Previously Presented) The method of claim 19 where the determining a click 
rate of the item includes: 

determining different click rates of the item for the group of non-malicious users, 
the different click rates corresponding to different time periods. 

27. (Previously Presented) The method of claim 26 where the different time periods 
include different times of a day or week. 

28. (Previously Presented) The method of claim 26 where the different time periods 
include different months of a year. 

29. (Currently Amended) A computer-readable memory device containing 
instructions for controlling at least one processor to perform a method for detecting a spamming 
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of an advertisement displayed by a server, the method comprising: 

identifying non-malicious visitors to the server , where identifying the non- 
malicious visitors includes identifying that the non-malicious visitors are not spam programs ; 

determining a click rate of the advertisement for the non-malicious visitors; and 
determining whether the advertisement has been spammed based at least in part 
on the determined click rate for the non-malicious visitors. 

30. (Previously Presented) A server comprising: 
a memory to store at least one item; and 

a processor to: 

cause the at least one item to be displayed, 

identify a number of non-malicious users accessing the server, 

compare the number of non-malicious users to a total number of users to 

obtain a percentage, 

set a click rate of the at least one item based at least in part on the 

percentage, and 

determine whether the at least one item has been spammed based at least 
in part on the click rate. 

3 1 . (Currently Amended) A method performed by one or more processors of one or 
more [[a]] server devices , the method comprising: 

tracking, by one or more processors a processor of the one or more server devices , 
activities of users visiting a web site that includes one or more advertising links , the tracking 
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including determining, for each user, at least one of; 

whether the user loads images, 

an age of a cookie associated with each user, 

whether the user has javascript turned on, 

a type of browser used by the user, or 

an interval at which the user visits the web site; [[and]] 
identifying, by the processor, non-malicious users from among the users visiting 
the web site based at least in part on the tracked activities; 

determining whether the advertising link has been spammed, where the 
determining includes: 

comparing an actual click rate of the advertising link by non-malicious 
users to an estimated click rate of the advertising link by non-malicious users, where the 
estimated click rate is based on historical data . 

32. (Previously Presented) The system of claim 16 where the means for identifying 
non-malicious visitors includes at least one of: 

means for determining whether visitors to the web site load images, 

means for determining whether the visitors to the web site have javascript turned 

on, 

means for determining a type of browser used by the visitors to the web site, 
means for determining an interval at which the visitors to the web site visit the 

web site, or 

means for determining a type of items for which searches are performed by the 
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visitors to the web site. 

33. (Canceled) 

34. (Previously Presented) The computer-readable memory device of claim 17 where 
the determining whether the advertisement has been click spammed based at least in part on the 
determined percentage includes: 

comparing the determined percentage of the non-malicious users clicking the 
advertisement to a percentage of non-malicious users clicking the advertisement from a different 
time period. 

35. (Previously Presented) The computer-readable memory device of claim 17 where 
the determining whether the advertisement has been click spammed includes: 

estimating a percentage of non-malicious users clicking the advertisement to be 
approximately a percentage of non-malicious users accessing the server, and 

determining that the advertisement has been clicked spammed when the 
determined percentage of non-malicious users clicking the advertisement is lower than the 
estimated percentage of non-malicious users clicking the advertisement. 

36. (Previously Presented) The server of claim 18 where, when determining whether 
the at least one advertisement has been click spammed, the processor is to: 

compare the determined percentage of the non-malicious users clicking the at 
least one advertisement to a percentage of non-malicious users clicking the at least one 
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advertisement from a different time period. 

37. (Previously Presented) The server of claim 18 where, when determining whether 
the at least one advertisement has been click spammed, the processor is to: 

estimate a percentage of non-malicious users clicking the at least one 
advertisement to be approximately a percentage of non-malicious users visiting the server, and 

determining that the at least one advertisement has been clicked spammed when 
the determined percentage of non-malicious users clicking the at least one advertisement is lower 
than the estimated percentage of non-malicious users clicking the at least one advertisement. 

38. (Previously Presented) The computer-readable memory device of claim 29 where 
the method further comprises: 

determining a total number of visitors to the server, and 

where the determining whether the advertisement has been spammed includes: 

comparing the determined click rate for the non-malicious visitors to a 
click rate for the total number of visitors to the web site, and 

determining that the advertisement has been spammed when the click rate 
for the total number of visitors exceeds the determined click rate for the non-malicious visitors. 

39. (Previously Presented) The computer-readable memory device 29 where the 
identifying non-malicious visitors to the server includes: 

tracking a factor associated with visitors to the server, the factor including at least 
one of whether the visitors load images, ages of cookies associated with the visitors, whether the 
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visitors have javascript turned on, types of browsers used by the visitors, or intervals at which the 

visitors visit the server, and 

using the tracked factor to identify the non-malicious visitors to the server. 

40. (Previously Presented) The server of claim 30 where, when identifying a number 
of non-malicious users accessing the server, the processor is to: 

track a factor associated with users accessing the server, the factor including at 
least one of whether the users load images, ages of cookies associated with the users, whether the 
users have javascript turned on, types of browsers used by the users, or intervals at which the 
users access the server, and 

use the factor to identify the number of non-malicious users accessing the server. 

41. (Previously Presented) The server of claim 30 where the at least one item 
includes an advertisement. 

42. (Currently Amended) The method of claim 31 further comprising: 
determining a quantity of the identified non-malicious users that clicks the [[an]] 

advertisement link associated with the web site ; and 

determining whether the advertisement has been spammed based on the 
determined quantity of the identified non-malicious users that clicks the advertisement. 

43. (Previously Presented) The method of claim 3 1 further comprising: 
determining that spamming occurs on the web site based on a behavior of the non- 
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malicious users visiting the web site. 

44. (New) The method of claim 1 where the determining the occurrence of spamming 
on the web site further includes: 

determining, based on the comparing, that the identified first proportion is greater 
than the identified second proportion. 

45. (New) The method of claim 1 where the determining that the occurrence of 
spamming on the web site further includes: 

determining, based on the comparing, that the identified first proportion is greater 
than the identified second proportion plus a predefined threshold. 

46. (New) The system of claim 16 where the means for identifying malicious visitors 
comprise means for identifying spam programs. 
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